CVE-2026-24765

Severity
7.8HIGH
EPSS
0.1%
top 68.56%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedJan 27

Description

PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages4 packages

Packagistphpunit/phpunit9.0.09.6.33+4
NVDphpunit_project/phpunit9.0.09.6.33+4
CVEListV5sebastianbergmann/phpunit< 8.5.52+4
Debianphpunit< 9.5.2-1+deb11u1+2

Also affects: Debian Linux 11.0

Patches

🔴Vulnerability Details

4
OSV
PHPUnit Vulnerable to Unsafe Deserialization in PHPT Code Coverage Handling2026-01-27
GHSA
PHPUnit Vulnerable to Unsafe Deserialization in PHPT Code Coverage Handling2026-01-27
OSV
CVE-2026-24765: PHPUnit is a testing framework for PHP2026-01-27
CVEList
PHPUnit Vulnerable to Unsafe Deserialization in PHPT Code Coverage Handling2026-01-27

📋Vendor Advisories

2
Red Hat
phpunit: PHPUnit: Arbitrary code execution via unsafe deserialization of code coverage files2026-01-27
Debian
CVE-2026-24765: phpunit - PHPUnit is a testing framework for PHP. A vulnerability has been discovered in v...2026

🕵️Threat Intelligence

1
Wiz
CVE-2026-24765 Impact, Exploitability, and Mitigation Steps | Wiz